.busbar-ref: record busbar 1.5.4 (4f42bb9dd5aad4e65d8524ba71a534cfecd… #28
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Real-world proof against an actual Entra ID (Azure AD) tenant, not a fixture or a mock. Runs | |
| # auth-oidc/examples/entra_live_check.rs, which performs a genuine password-grant token request | |
| # against a disposable test tenant + test user (both provisioned as repo secrets — never a real | |
| # employee identity), then drives that real Entra-issued token through this crate's own | |
| # OidcModule/ReqwestFetcher: real discovery document, real JWKS fetch, real RS256 signature check, | |
| # real claim validation, plus a tamper check confirming a corrupted signature is genuinely rejected. | |
| # | |
| # This complements, not replaces, the hermetic dlopen ABI tests in ci.yml (plugin-ci.yml) — those | |
| # prove the ABI seam and the crypto path work at all, with no external dependency; this proves the | |
| # code actually interoperates with a real-world IdP's real quirks (issuer format, token shape, | |
| # claims) rather than only a synthetic fixture. | |
| # | |
| # Runs on push to main and on demand. Not on pull_request — forked PRs don't have access to repo | |
| # secrets, and the example already exits cleanly (SKIP, not fail) if the ENTRA_* secrets are absent, | |
| # so this only ever runs where the tenant is actually provisioned. | |
| name: entra-live-check | |
| env: | |
| # Same BUSBAR_REF convention ci.yml / release.yml already establish for the sibling path | |
| # dependency (busbar-api) this crate needs. Update to `main` once busbar 1.5.0 ships. | |
| BUSBAR_REF: dev | |
| on: | |
| push: | |
| branches: [main] | |
| workflow_dispatch: {} | |
| jobs: | |
| entra-live-check: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout auth-oidc | |
| uses: actions/checkout@v7 | |
| with: | |
| path: auth-oidc | |
| - name: Checkout busbar (sibling path dependency) | |
| uses: actions/checkout@v7 | |
| with: | |
| repository: GetBusbar/busbar | |
| ref: ${{ env.BUSBAR_REF }} | |
| path: busbarAI | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: Swatinem/rust-cache@v2 | |
| - name: Real Entra ID token verification | |
| working-directory: auth-oidc | |
| env: | |
| ENTRA_TENANT_ID: ${{ secrets.ENTRA_TENANT_ID }} | |
| ENTRA_CLIENT_ID: ${{ secrets.ENTRA_CLIENT_ID }} | |
| # Optional: only set when the app registration is a CONFIDENTIAL client (i.e. "Allow | |
| # public client flows" is off). Absent, the check sends no secret, which is what a public | |
| # client requires. | |
| ENTRA_CLIENT_SECRET: ${{ secrets.ENTRA_CLIENT_SECRET }} | |
| ENTRA_TEST_USERNAME: ${{ secrets.ENTRA_TEST_USERNAME }} | |
| ENTRA_TEST_PASSWORD: ${{ secrets.ENTRA_TEST_PASSWORD }} | |
| run: cargo run --example entra_live_check |